Enhancing DDoS detection in SDIoT through effective feature selection with SMOTE-ENN.

Area of Science:

• Cybersecurity
• Network Security
• Internet of Things (IoT)

Background:

• The Internet of Things (IoT) enables device connectivity but introduces Distributed Denial of Services (DDoS) threats.
• Software Defined-Internet of Things (SDIoT) offers enhanced security but faces challenges like limited resources and protocol heterogeneity.
• There is a critical need for efficient and low-cost DDoS attack classifiers in SDIoT environments.

Purpose of the Study:

• To develop an improved feature selection (FS) technique for enhanced DDoS attack detection in IoT.
• To reduce training time and improve the detection rate of DDoS attacks in Software Defined-Internet of Things (SDIoT).
• To address data imbalance and multicollinearity issues in DDoS detection datasets.

Main Methods:

• Data imbalance was addressed using Edited Nearest Neighbor-based Synthetic Minority Oversampling (SMOTE-ENN).
• A novel FS method, SFMI, combining Sequential Feature Selection (SFE) and Mutual Information (MI), was proposed.
• Principal Component Analysis (PCA) was used to handle multicollinearity, followed by classification using Random Forest (RF).

Main Results:

• The proposed SMOTE-ENN+SFMI+PCA approach with RF classifier achieved 99.97% accuracy.
• The method demonstrated a precision of 99.39% using only 10 selected features.
• Experiments were validated on KDDCup99 and CIC IoT-2023 benchmark datasets.

Conclusions:

• The integrated approach effectively enhances DDoS detection accuracy and efficiency in IoT networks.
• The proposed feature selection method significantly reduces the number of features required for high-performance classification.
• This research offers a cost-effective solution for securing the growing SDIoT ecosystem against sophisticated cyber threats.